read_resource MCP tool is missing the :read-only? annotation, causing clients to treat it as a write/destructive tool

Nobody has claimed this yet.

### Describe the bug

Summary

The read_resource tool exposed via the MCP server (i beleve via POST /v1/read-resource in [src/metabase/agent_api/api.clj](https://github.com/metabase/metabase/blob/master/src/metabase/agent_api/api.clj)) is missing the :annotations {:read-only? true} metadata that every other read-only tool in the same file declares. As a result, MCP clients (observed in both Claude and Ambersearch) that build their permission UI from the readOnlyHint annotation classify read_resource as a write/delete tool, even though it only reads data.

### To Reproduce

connect metabase to a MCP client (e.g. claude or ambersearch) and check the exposed MCP tools:

### Expected behavior

read only tools should be exposed as read-only tools to mcp clients, as otherwise tools may always ask user for permission to use this tool

### Logs

_No response_

### Information about your Metabase installation

```JSON
{
"browser-info": {
"language": "de",
"platform": "Win32",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0",
"vendor": "Google Inc."
},
"metabase-info": {
"databases": [
"postgres",
"sqlite",
"mysql",
"sqlserver"
],
"run-mode": "prod",
"plan-alias": "",
"version": {
"date": "2026-08-19",
"tag": "v0.63.14",
"hash": "8429d62"
},
"settings": {
"report-timezone": null
},
"hosting-env": "unknown",
"application-database": "postgres",
"application-database-details": {
"database": {
"name": "PostgreSQL",
"version": "16.14 (Debian 16.14-1.pgdg13+1)"
},
"jdbc-driver": {
"name": "PostgreSQL JDBC Driver",
"version": "42.7.12"
}
}
},
"system-info": {
"file.encoding": "UTF-8",
"java.runtime.name": "OpenJDK Runtime Environment",
"java.runtime.version": "25.0.3+9-LTS",
"java.vendor": "Eclipse Adoptium",
"java.vendor.url": "https://adoptium.net/",
"java.version": "25.0.3",
"java.vm.name": "OpenJDK 64-Bit Server VM",
"java.vm.version": "25.0.3+9-LTS",
"jvm.available-processors": 2,
"jvm.max-memory": "850.0 MB",
"os.name": "Linux",
"os.version": "7.0.0-29-generic",
"system.total-memory": "3.3 GB",
"user.language": "en",
"user.timezone": "Europe/Berlin"
}
}
```

### Severity

annoying

### Additional context

_No response_

Start in src/metabase/agent_api/api.clj at the read_resource MCP tool exposed through POST /v1/read-resource. Compare its metadata with the other read-only tools in the same file. Done means read_resource exposes the read-only annotation so MCP clients classify it as non-destructive.

Written by the indexing model from the issue text.